Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-13854: Curved Text <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (curved-text)

CVE ID CVE-2025-13854
Plugin curved-text
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 0.1
Patched Version —
Disclosed January 7, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-13854 (metadata-based):
This vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw in the Curved Text WordPress plugin, version 0.1. The vulnerability exists within the ‘arctext’ shortcode handler, specifically in its handling of the ‘radius’ attribute. Attackers with Contributor-level access or higher can inject malicious scripts that execute in the context of any user viewing a page containing the compromised shortcode.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping. The plugin likely accepts user-supplied input for the ‘radius’ shortcode attribute and directly echoes it into the page without proper neutralization. This inference is based on the CWE-79 classification and the vulnerability description. Without access to the patched version or source code diff, this conclusion is derived from the standard failure pattern for WordPress shortcode XSS vulnerabilities.

Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post or page, inserting the vulnerable shortcode with a malicious payload in the ‘radius’ attribute. The payload would be a JavaScript payload, such as `alert(‘XSS’)`, likely requiring HTML encoding or quotes to fit within the shortcode attribute context. The attack vector is the WordPress editor, not a direct HTTP endpoint, making WAF detection more challenging.

Remediation requires implementing proper output escaping. The plugin should use WordPress core escaping functions like `esc_attr()` when outputting the ‘radius’ attribute value within HTML. Input sanitization for shortcode attributes, using functions like `sanitize_text_field()`, is also a recommended defense-in-depth measure. A proper fix would validate the ‘radius’ value as a numeric parameter before use.

Successful exploitation leads to stored XSS. Injected scripts execute in the browser of any user who views the compromised page. This can result in session hijacking, administrative actions performed on behalf of the user, defacement, or malicious redirects. The CVSS vector indicates scope change (S:C), meaning the impact can propagate to other site components beyond the plugin itself.

Differential between vulnerable and patched code

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13854 - Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/**
 * This PoC simulates an authenticated Contributor user injecting a malicious shortcode into a post.
 * It assumes valid WordPress credentials and the ability to create/edit posts.
 * The exploit occurs via the standard WordPress post editor, not a direct plugin endpoint.
 * Therefore, a direct HTTP PoC using cURL is not feasible without simulating the entire WordPress editor workflow (nonce, post ID, etc.).
 * The attack is performed manually through the admin interface.
 * A meaningful automated PoC would require full WordPress environment simulation.
 */
return null;

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School